The billion Binance hack: North Korea link explained

Investigators have linked the billion Binance hack — a $6.3 billion theft executed in about 20 minutes — to North Korea's TraderTraitor group, the same unit blamed for last year's $1.5 billion Bybit heist. Binance says it will cover all losses and has frozen roughly $3 billion in affected assets.

Key Takeaways

• Blockchain firm TRM Labs tied the $6.3 billion Binance theft to North Korea's TraderTraitor unit with high confidence.
• Stolen funds moved across 10 blockchain networks in roughly 20 minutes, forcing Binance to suspend withdrawals.
• Binance says it will cover losses, has frozen about $3 billion, and set aside roughly $6.34 billion in company funds.
• Chainalysis and Elliptic also linked the heist to North Korea; Binance has not yet confirmed the culprit.
• The scale eclipses last year's $1.5 billion Bybit theft, also blamed on TraderTraitor — a stark then-and-now shift in crypto crime.

For readers who follow how today's headlines echo earlier eras of digital risk, our Nostalgia: Then & Now hub tracks moments when the past and present collide — and few stories fit that frame like the billion Binance hack.

Who is behind the billion Binance hack?

According to reporting from Mashable, blockchain analysis firm TRM Labs has attributed the attack to TraderTraitor, a North Korean hacking unit. TRM did so with "high confidence."

That same unit was blamed for last year's $1.5 billion Bybit heist. Chainalysis and Elliptic have also linked the Binance theft to North Korea. Binance itself has not yet confirmed who was responsible.

Elliptic said some stolen funds reached an address that had also received proceeds from a suspected North Korean attack on crypto exchange Bitget. North Korea has previously denied hacking allegations.

The attribution matters because it frames the billion Binance hack not as a one-off breach, but as part of a pattern investigators already associate with TraderTraitor and related North Korea–linked thefts.

How did the theft unfold so quickly?

It took about 20 minutes for hackers to move billions of dollars out of Binance, described as the world's largest cryptocurrency exchange. TRM Labs said most of the stolen cryptocurrency was moved from Binance's wallets across 10 blockchain networks in that window.

The firm said the attack shared characteristics with previous North Korea–linked thefts, including the Bybit heist. That speed — billions shifted before many users would have refreshed a balance page — helps explain why the incident is being discussed as potentially the biggest hack of all time, and possibly the biggest heist of any kind, ever.

Binance initially said a compromised engineer's laptop may have allowed an attacker to submit unauthorized withdrawals. Its subsequent investigation uncovered additional points of breach. The company has promised a full report once the facts are verified.

Until that report lands, the public picture rests on the forensic links from TRM, Chainalysis, and Elliptic, and on Binance's own early account of how access may have begun.

What is Binance doing for customers now?

The attack forced Binance to suspend withdrawals. The company says it will cover all losses and has worked with partners to freeze roughly $3 billion in affected assets.

Reuters reports that Binance has set aside approximately $6.34 billion in company funds to cover losses — a figure that closely matches the headline scale of the billion Binance hack itself.

Deposits have resumed. The exchange said early Friday that withdrawals were expected to return within 48 hours. For customers, those steps — covering losses, freezing funds, restoring deposits, and targeting a short window for withdrawals — are the immediate practical answer to whether the platform intends to make users whole.

A full public accounting of every breach point is still pending. Binance has said it will publish a complete report after the facts are verified, which should clarify how a compromised device and any further access paths combined into a theft of this size.

How does this compare with past crypto heists?

Then: last year's Bybit heist, at $1.5 billion, was already a record-breaking crypto theft linked to TraderTraitor. Now: the billion Binance hack, at $6.3 billion, dwarfs that figure and arrives with the same suspected fingerprint from investigators.

Elliptic's observation that some funds touched an address also tied to a suspected North Korean attack on Bitget adds another then-and-now thread — prior incidents feeding into the same attribution story investigators are telling today.

In other words, the nostalgia angle is not soft focus. It is a hard comparison of scale and suspect. What once looked like an extreme outlier in crypto security has been overtaken, in dollar terms, by a single event that moved value across 10 chains in minutes.

Whether history will permanently rank this as the largest heist ever remains a matter of how investigators and markets define the category. What the current reporting supports is clearer: a $6.3 billion Binance theft, rapid cross-chain movement, overlapping forensic links to North Korea's TraderTraitor, and an exchange publicly committing capital and freezes to cover customer losses while it finishes its own investigation.

As more verified details emerge — including Binance's promised full report — the then-and-now ledger of major crypto heists will sharpen. For now, the billion Binance hack stands as the moment the previous high-water mark was not merely matched, but multiplied.